Support Forums

I have few questions regarding System Restore Points...

1. When I run Harlan's SysRestore.pl script on ProDiscover IR with an image opened, the script outputs "No registries to process." I have tried to run the script by clicking the Run ProScript from button bar as well as right-clicking and Run ProScript on rp.log files and root folders but output is still the same.
Is there a special method to run the script?

2. How can I extract the NTUSER.DAT data from the System Restore Points? If I simply extract out what looks like the NTUSER.DAT file for the user in question using ProDiscover, the extracted file doesn't open in AccessData's Registry Viewer?

3. Regarding Harlan's RipXP - does it require the original NTUSER.DAT file to work? The current scenario I have is a user's entire profile was deleted so I don't have the "live" NTUSER.DAT, thus my keen interest in the restore points!
Sent at 3:25 PM on Tuesday

blinktude,

As we discussed on the phone, the registry has to be loaded into the project for Harlan's script to work. To load the registry; right-click on the Windows directory in Content View and select "Add to registry viewer". After the function as completed the script should work fine for you.